DCA Hardened Secrets Manager for OpenBao — Support & Quick Start

At a glance

Quick start

This is the listing's usage information, verbatim. Every command in it is run by our QA on a freshly launched instance before an image version can publish, so the text and the tested procedure cannot drift apart.

After launch:

1. Connect over SSH as the opc user with the key you supplied at launch:

   ssh opc@PUBLIC_IP

2. OpenBao runs as a systemd service bound to 127.0.0.1:8200 only, TLS-terminated with a certificate generated uniquely for this instance at first boot. Check status:

   sudo systemctl status openbao

3. The image ships uninitialized: no root token or unseal keys exist until you mint them. Initialize once, then unseal with 3 of the 5 keys it prints:

   export BAO_ADDR=https://127.0.0.1:8200
   export BAO_SKIP_VERIFY=true   # only until you install a certificate your clients trust
   bao operator init
   bao operator unseal   # run it three times, one key each; bao status then reports Sealed false

4. Smoke-test with the Initial Root Token that init printed (store it and the unseal keys off the instance; they are shown once and cannot be recovered):

   export BAO_TOKEN=INITIAL_ROOT_TOKEN
   bao secrets enable -path=secret kv-v2
   bao kv put -mount=secret smoke hello=world
   bao kv get -field=hello -mount=secret smoke

5. To reach OpenBao from your application tier, expose it deliberately: install a certificate your clients trust as /etc/openbao/tls/tls.crt and /etc/openbao/tls/tls.key (owner openbao, key mode 0600), then bind the listener to all interfaces and restart:

   sudo sed -i 's/"127.0.0.1:8200"/"0.0.0.0:8200"/' /etc/openbao/bao.hcl
   sudo systemctl restart openbao   # OpenBao restarts sealed: unseal again as in step 3

   Port 8200 is already permitted in the host firewall. Restrict it in your VCN security list to the application tier's CIDR; never expose a secrets store to the internet. The cluster port (8201) remains blocked by the host firewall.

6. Data (Raft integrated storage) lives in /var/lib/openbao; for production, back it with a block volume. The first-boot TLS material lives in /etc/openbao/tls/.

The image is CVE-patched at build time. OpenBao itself comes from the upstream release RPM (upgrade it by installing a newer openbao_VERSION_linux_amd64.rpm from github.com/openbao/openbao/releases); apply OS updates with:

sudo dnf -y update

What the image provides

• OpenBao 2.5.5, installed from the project's signed release RPM, running as a dedicated unprivileged service with the Raft integrated storage backend.
• Instance-unique TLS. On first boot the image generates a fresh 4096-bit key and certificate; no key material is baked into the image, so every deployed instance is cryptographically distinct.
• Loopback-bound by default. The listener answers only on 127.0.0.1 until you supply your own certificate and open it deliberately — a secrets store is never exposed to the network by accident.
• Security hardening aligned to the Oracle Cloud Marketplace image standards: SELinux enforcing, host firewall default-deny with only SSH and the OpenBao port permitted, no account with a usable password, no stray keys, and the image fully patched at build time.
• No swap is configured, following OpenBao's guidance now that it no longer uses mlock, and a least-privilege systemd unit with no Linux capabilities (NoNewPrivileges, ProtectSystem, ProtectHome, PrivateTmp).

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or use the contact form. Include the listing name, your OCI region, the instance OCID and the output of sudo journalctl -u <service> -n 100 for the unit named in the quick start.

OpenBao is a trademark of the Linux Foundation. This image is an independent hardened distribution and is not affiliated with, endorsed by, or sponsored by the OpenBao project or the Linux Foundation.